PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50148 Siemens CVE debrief

This CVE addresses a wild-memory-access vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) subsystem. The issue stems from improper error handling in the bnep_init() function, which ignores the return value of bnep_sock_init(). When bnep_sock_init() fails and cleans up its resources, subsequent module removal triggers bnep_sock_cleanup() to access already-freed memory, leading to a use-after-free condition. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low attack complexity and privileges required, resulting in high availability impact. The vulnerability was published on 2024-04-09 and last modified on 2026-05-14. Siemens has identified this as affecting the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP industrial control devices. No patch is currently available from the vendor.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled, OT security teams managing Bluetooth-capable industrial devices, and Linux kernel maintainers supporting Bluetooth networking stacks in embedded industrial environments.

Technical summary

The vulnerability exists in the Bluetooth BNEP protocol implementation within the Linux kernel. The bnep_init() function fails to check the return value of bnep_sock_init(), which can fail and perform resource cleanup. When the BNEP module is subsequently removed, bnep_sock_cleanup() attempts to clean up socket resources that have already been freed, resulting in wild memory access. The fix involves properly propagating bnep_sock_init()'s return value through bnep_exit() to prevent the cleanup sequence from executing on failed initialization. This is a local vulnerability requiring low privileges, with exploitation leading to denial of service through system crash.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem on affected Siemens SIMATIC S7-1500 TM MFP devices to trusted personnel only
  • Implement application whitelisting to ensure only trusted applications are built and executed on the GNU/Linux subsystem
  • Monitor for anomalous Bluetooth module loading/unloading activity on affected systems
  • Apply vendor patches when released by Siemens
  • Review and implement CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-24-102-01 and Siemens security advisory SSA-265688. CVSS vector confirmed as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Affected product identified through CSAF product tree as SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Remediation status confirmed as 'none_available' in source advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50148 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50148

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50148 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50148

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.